CVE Vulnerabilities - 26 September 2026

The UP plugin for Joomla from lomart.fr (versions 5.0.0 through 5.2.0 and 6.0.0 through 6.0.29) lets anyone on the internet add and run their own code on the server without logging in. This can let at...

A version of the Froxlor control panel lets a customer with only subdomain‑creation rights add a specially crafted URL that inserts hidden characters into the web‑server configuration. When the panel ...

The Froxlor control panel versions up to 2.3.10 let a logged‑in customer schedule a data export that can be redirected through a symbolic link. When the scheduled job runs, it changes the ownership of...

Kyverno versions earlier than 1.19.1 do not correctly check specially encoded URLs in its policy calls. This mistake lets a user in one namespace create resources, such as webhooks or policy exception...

The Ultra Addons for Contact Form 7 plugin for WordPress can let anyone upload files to your server when its PDF Generator feature is turned on. This could let an attacker place malicious code on the ...

The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress can let someone sign in as an administrator without a password or one‑time code. This happens when several specific OT...

The YouTube Gallery add‑on for Joomla versions before 5.7.3 lets anyone send specially crafted video search or sorting requests that cause the site’s database to execute unwanted commands. This could ...

The Unbound DNS resolver and its library on Red Hat systems have a security gap that could let a remote attacker execute code on the server. This could compromise the machine and any data it handles. ...

The Unbound DNS resolver and its library on Red Hat systems contain a flaw that could let an attacker run code on the server. This could give the attacker control over the affected machine and any dat...

The Request a Quote for WooCommerce plugin for WordPress (versions up to 2.9.2) lets people who are not logged in upload files through a popup form. Because the upload handler does not check the file ...

The loki component in the cleanstart/loki Go library has a weakness that could let an attacker cause it to run code they provide. This could lead to data leakage or system compromise. Update to the la...

The loki component used in the cleanstart/loki package has a security weakness that could let an attacker read or alter data it processes. This could expose sensitive information or disrupt logging fu...

The Go JOSE library used by cleanstart/loki has a flaw that could allow a malicious user to alter or read information that should be protected by encryption or digital signatures. This puts the confid...

The Loki software can fail to verify the source of a connection if a callback other than a public‑key is used, allowing unauthorized access. This bypass lets attackers avoid the usual address validati...

The Loki software can fail to recognize when a signing key has been revoked, allowing potentially untrusted code to be accepted as valid. This could let attackers introduce malicious components that a...

The Loki software may get stuck when it tries to send a single block of data larger than 4 gigabytes over an SSH connection. The problem causes the program to keep sending empty packets without actual...

The Loki software’s in‑memory key storage can accept keys that are supposed to require user confirmation before they are used, but it does not actually enforce that check. This means a malicious or un...

The loki software from cleanstart can be tricked when a new key is added to a remote agent, allowing someone to modify the rules that limit where connections can go. This could let an attacker redirec...

The Loki software package used by cleanstart can incorrectly verify signatures from certain hardware security keys. This could let an attacker pretend to be a legitimate user. Update Loki to the lates...

The Loki software that handles SSH connections can be tricked by a malicious server into filling its internal memory with unexpected messages. This can stop the program from reading further data, effe...

The Loki software may stop working if it receives specially formed encrypted messages. This happens because the program mistakenly treats raw data as a number, causing it to panic. Update Loki to the ...

The Loki software does not check the size of RSA or DSA public‑key values, allowing unusually large keys to be processed. This could be used to cause the program to run out of memory or crash, potenti...

The Loki SSH service can run out of memory if an authorized user repeatedly tries to open connections that the server refuses, eventually causing the server to stop working. When the server crashes, a...

Both the Loki logging system and the Secrets‑Store CSI driver for AWS can spend a lot of CPU when they try to read specially crafted web pages. This high CPU use can slow down or temporarily stop the ...

The Loki software that handles SSH logins can lose the extra rules attached to a user’s certificate when a certain authentication step succeeds. This means the intended limits, like forcing a specific...